From: MichaelDBA <MichaelDBA@sqlexec.com>
To: Erik Wienhold <ewie@ewie.name>
Cc: Phani Prathyush Somayajula <phani.somayajula@pragmaticplay.com>
Cc: pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
Subject: Re: Restrict Write Users
Date: Tue, 20 Jun 2023 08:57:16 -0400
Message-ID: <c94d8b38-503a-15d1-25d2-dcad977c6bff@sqlexec.com> (raw)
In-Reply-To: <4796978.1031811.1687262753268@office.mailbox.org>
References: <VI1PR10MB76716A9822F3326AF01E545C8D5CA@VI1PR10MB7671.EURPRD10.PROD.OUTLOOK.COM>
<4796978.1031811.1687262753268@office.mailbox.org>
Everything that Erik said is good, but looking at this from a bird's eye
view, I would recommend using this general approach which will make it
soooooo much easier to manage user privileges:
NEVER assign privileges directory to a LOGIN role. ONLY assign
privileges to a NON-LOGIN roles (following rules like the ones specified
by Erik).
Then when you have your NON-LOGIN roles (aka groups) defined with
appropriate privileges, you can easily effect them on LOGIN users by
simply adding or removing them from belonging to groups (NON-LOGIN roles).
Assuming you defined a WRITE and READ NON-LOGIN roles, you can easily
remove a LOGIN user from the WRITE group and add them to the READ group.
Erik Wienhold wrote on 6/20/2023 8:05 AM:
>> On 20/06/2023 13:23 CEST Phani Prathyush Somayajula <phani.somayajula@pragmaticplay.com> wrote:
>>
>> Is there a way to restrict write access to a user by restricting the user to
>> have read-only on other databases on the instance. I’m using postgresql-14
>> version
> You should look into https://www.postgresql.org/docs/14/ddl-priv.html.
>
> Start with a user that has no privileges and grant additional privileges as
> necessary give read and/or write access. The user must not be the owner of
> database objects, must not be a member of an owner role, and must not be
> a superuser. Also check default privileges and privileges granted to PUBLIC.
>
> But granting privileges in one database does not affect privileges in other
> databases, except for role memberships because roles are not tied to a specific
> database.
>
> --
> Erik
>
>
Regards,
Michael Vitale
Michaeldba@sqlexec.com <mailto:michaelvitale@sqlexec.com>
703-600-9343
Attachments:
[image/jpeg] pgadvanced3.jpg (20.6K, ../c94d8b38-503a-15d1-25d2-dcad977c6bff@sqlexec.com/3-pgadvanced3.jpg)
download | view image
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: MichaelDBA@sqlexec.com, ewie@ewie.name, phani.somayajula@pragmaticplay.com, pgsql-admin@lists.postgresql.org
Subject: Re: Restrict Write Users
In-Reply-To: <c94d8b38-503a-15d1-25d2-dcad977c6bff@sqlexec.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox